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1 . A method comprising: 

identifying a selected permission level associated with a child's access to a 
Web server; 

obtaining a relationship ticket from an authentication server; 
generating a request to set the selected permission level; 
sending the request and the relationship ticket to the Web server; and 
receiving a success code from the Web server if the selected permission 
level is established. 



,,„ 2. A method as recited in claim 1 further including receiving a failure 

I II notification from the Web server if the selected permission level is not established. 



13 
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3. 



method as recited in claim 1 wherein sending the request to the 



15 Web server includes using an 



untrusted connection with the Web server. 



16 

17 

18 

19 

20 

21 

22 

23 

24 

25 



4. A method as recited in claim 1 wherein the request to the Web server 
is sent using an unsecure connection with the Web server. 

5. A method as recited in claim 1 wherein the relationship ticket is 
encrypted by the authentication server. 

6. A method as recited in claim 1 wherein the selected permission level 
is established if the relationship ticket is authenticated. 
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7. A method as recited in claim 1 wherein the relationship ticket 
includes the child's identity. 

8. A method as recited in claim 1 wherein the relationship ticket 
includes a parent's identity. 

9. A method as recited in claim 1 wherein the relationship ticket 

includes: 

the child's identity; 
a parent's identity; and 

a relationship between the child and the parent. 

10. A method as recited in claim 1 wherein the authentication server is a 
.NET Passport server. 

11. A method as recited in claim 1 wherein selecting a permission level 
associated with a child's usage of a web site is performed by a parent of the child. 

12. One or more computer-readable memories containing a computer 
program that is executable by a processor to perform the method recited in claim 
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13. A method comprising: 

identifying a selected permission level associated with a user's access to a 
Web server; 

obtaining a relationship ticket from an authentication server; 
generating a request to set the selected permission level; 
sending the request and the relationship ticket to the Web server via an 
unsecure connection; and 

receiving a success code from the Web server if the selected permission 

level is established. 

14. A method as recited in claim 13 wherein the relationship ticket is 
encrypted by the authentication server. 

15. A method as recited in claim 13 wherein the relationship ticket is 
encrypted by the authentication server, and wherein the relationship ticket is 
decrypted by the Web server. 

16. A method as recited in claim 13 wherein the user is an employee 
and the permission level is selected by an employer of the employee. 

17. A method as recited in claim 16 wherein the relationship ticket 
includes the employee's identity and the employer's identity. 
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18. One or more computer-readable memories containing a computer 
program that is executable by a processor to perform the method recited in claim 
13. 

19. A method comprising: 

identifying a modified permission level associated with a user's access to a 
Web service; 

obtaining an encrypted relationship ticket from an authentication server; 
generating a request to modify the selected permission level associated with 
the user's access to the Web service; 

sending the request and the encrypted relationship ticket to the Web service 

via an unsecure connection; and 

receiving a success code from the Web service if the modified permission 

level is established. 

20. A method as recited in claim 19 further comprising receiving a 
failure notification from the Web service if the modified permission level is not 
established. 

21. A method as recited in claim 19 wherein the modified permission 
level is established if the encrypted relationship ticket is authenticated by the Web 
service. 
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22. A method as recited in claim 19 wherein the encrypted relationship 
ticket includes the user's identity. 



23. One or more computer-readable memories containing a computer 
program that is executable by a processor to perform the method recited in claim 
19. 

24. An apparatus comprising: 

an interface to receive requests to establish Web access permissions via an 

unsecure communication link; 

a storage device to store manager-associate relationship information; and 
a processor coupled to the interface and the storage device, the processor to 
receive a relationship ticket from a client device and decrypt the relationship 
ticket, the processor further to authenticate the relationship ticket and establish the 
requested Web access permissions if the relationship ticket is authenticated. 

25. An apparatus as recited in claim 24 wherein the processor is further 
to generate a success code if the relationship ticket is authenticated. 

26. An apparatus as recited in claim 24 wherein the processor is further 
to generate a failure notification if the relationship ticket is not authenticated. 

27. An apparatus as recited in claim 24 wherein the storage device 
further stores Web access permission information. 
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28. One or more computer-readable media having stored thereon a 
computer program that, when executed by one or more processors, causes the one 

or more processors to: 

select a permission level associated with an associate's access to a Web 

server; 

obtain a relationship ticket from an authentication server; 
generate a request to set the selected permission level; 
send the request and the relationship ticket to the Web server via an 
unsecure communication link; and 

receive a success code from the Web server if the requested permission 

level is established. 

29. One or more computer-readable media as recited in claim 28 
wherein the relationship ticket is encrypted by the authentication server and 
decrypted by the Web server. 

30. One or more computer-readable media as recited in claim 28 
wherein the relationship ticket includes the associate's identity. 

31. One or more computer-readable media as recited in claim 28 
wherein the relationship ticket includes a manager's identity. 
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